Fix unmanaged reconciliation review blockers

Co-authored-by: genichin <4282227+genichin@users.noreply.github.com>

trex_core/runtime/broker_provider.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 
 import os
 from dataclasses import dataclass
-from datetime import date, datetime, timedelta, timezone
+from datetime import UTC, date, datetime, timedelta, timezone
 from typing import Literal, Protocol
 
 from trex_core.adapters.broker.paper import PaperBroker
@@ -33,6 +33,7 @@ class BrokerCredentialUnavailable(RuntimeError):
 
 class BrokerProvider(Protocol):
     def get_broker_for_read(self) -> tuple[BrokerPort, BrokerSource]: ...
+    def get_broker_for_reconciliation(self) -> tuple[BrokerPort, BrokerSource]: ...
     def refresh_day_start_credential(self) -> BrokerSource: ...
 
 
@@ -80,7 +81,7 @@ class ConfigBrokerProvider:
     def __init__(self, config: DaemonConfig, *, read_port=None, clock=None) -> None:
         self._config = config
         self._read = read_port
-        self._clock = clock or (lambda: datetime.now(tz=timezone.utc))
+        self._clock = clock or (lambda: datetime.now(tz=UTC))
         self._broker: BrokerPort | None = None
         self._source: BrokerSource | None = None
         self._credential_date: date | None = None
@@ -101,7 +102,7 @@ class ConfigBrokerProvider:
             raise BrokerCredentialUnavailable("portfolio_hub_unavailable") from None
         except BrokerCredentialUnavailable:
             raise
-        except Exception:
+        except Exception:  # noqa: BLE001 - sanitize arbitrary read adapter failures
             raise BrokerCredentialUnavailable("portfolio_hub_unavailable") from None
         if ctx is None or getattr(ctx, "broker", None) is None:
             raise BrokerCredentialUnavailable("broker_absent")
@@ -121,7 +122,7 @@ class ConfigBrokerProvider:
                 self._broker = broker
             else:
                 self._broker.reinitialize(credential)  # type: ignore[attr-defined]
-        except Exception:
+        except Exception:  # noqa: BLE001 - sanitize broker construction/reload failures
             raise BrokerCredentialUnavailable("broker_initialization_failed") from None
         self._credential_date = self._clock().astimezone(_KST).date()
         # Version is designated non-secret by the portfolio contract; no account/key material.
@@ -147,6 +148,13 @@ class ConfigBrokerProvider:
         self._source = source
         return self._broker, source  # type: ignore[return-value]
 
+    def get_broker_for_reconciliation(self) -> tuple[BrokerPort, BrokerSource]:
+        broker, source = self.get_broker_for_read()
+        authoritative_reader = getattr(broker, "authoritative_balance_reader", None)
+        if callable(authoritative_reader):
+            return authoritative_reader(), source
+        return broker, source
+
     def refresh_day_start_credential(self) -> BrokerSource:
         # Paper/env/break-glass paths deliberately do no portfolio-hub call.
         if self._config.broker != "kis" or not self._config.credential_fetch_enabled or _break_glass_enabled():